fix: align template with bare starter

.github/workflows/test.yml

@@ -21,13 +21,39 @@ jobs:
       - run: npm ci --ignore-scripts
       - run: npm run validate
       - run: npm test
-      # Not audit/benchmark: the bare starter ships with zero example routes by
-      # design, and both refuse to run against a project with no active routes.
-      # Add them back once this starter has routes to check.
+  readiness:
+    needs: test
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '26'
+          cache: npm
+      - run: npm ci --ignore-scripts
+      - name: Allow only the initial empty-project audit result
+        run: |
+          set +e
+          output="$(npm run audit -- --compliance baseline)"
+          status=$?
+          set -e
+          printf '%s\n' "$output"
+          report="$(printf '%s\n' "$output" | tail -n 1)"
+          node -e '
+            const [status, report] = process.argv.slice(1);
+            const parsed = JSON.parse(report);
+            process.exit(status === "1" && parsed.ready === false &&
+              Array.isArray(parsed.notReadyReasons) &&
+              parsed.notReadyReasons.length === 1 &&
+              parsed.notReadyReasons[0] === "no-active-routes" ? 0 : 1);
+          ' "$status" "$report"
   verify-complete:
     name: verify-complete
-    needs: test
+    needs: [test, readiness]
     if: always()
     runs-on: ubuntu-latest
     steps:
-      - run: test "${{ needs.test.result }}" = success
+      - run: test "${{ needs.test.result }}" = success && test "${{ needs.readiness.result }}" = success

AGENTS.md

@@ -59,7 +59,7 @@ urlcode test
 urlcode audit --expect-routes 0
 ```
 
-With no active routes, this initial audit intentionally exits nonzero with `no-active-routes`. Add the first route and its fixture, then make the audit pass; remove `allow-empty-project: true` from the generated GitHub workflow at that point. `N` counts declared routes plus one route for each active `site.*` convention; an audit mismatch reports the declared/generated split. Update it deliberately and add `tests/requests.json` fixtures for every new route (positive/negative, every active method, HEAD). No global install: in this pinned npm project use `node node_modules/@jimhoyd/urlcode/dist/cli.js`; use `node /path/to/urlcode/packages/core/src/cli.ts` only in a runtime source checkout.
+With no active routes, this initial audit intentionally exits nonzero with `no-active-routes`. Add the first route and its fixture, then make the audit pass; remove the empty-project exception from the generated GitHub workflow at that point. `N` counts declared routes plus one route for each active `site.*` convention; an audit mismatch reports the declared/generated split. Update it deliberately and add `tests/requests.json` fixtures for every new route (positive/negative, every active method, HEAD). No global install: in this pinned npm project use `node node_modules/@jimhoyd/urlcode/dist/cli.js`; use `node /path/to/urlcode/packages/core/src/cli.ts` only in a runtime source checkout.
 
 ## Feedback
 

Makefile

@@ -1,7 +1,8 @@
 .DEFAULT_GOAL := help
 
-# Install the runtime separately, or override: URLCODE='node /path/to/urlcode/dist/cli.js'
-URLCODE ?= urlcode
+# Uses the pinned project dependency after `npm ci`; otherwise falls back to a
+# separately installed runtime. Override: URLCODE='node /path/to/urlcode/dist/cli.js'
+URLCODE ?= $(if $(wildcard node_modules/.bin/urlcode),node_modules/.bin/urlcode,urlcode)
 HOST ?= 127.0.0.1
 PORT ?= 3000
 
@@ -10,6 +11,9 @@ help:
 	@echo "make dev       Run this app with reload and .env.local"
 	@echo "make validate  Validate this app and its local bindings"
 	@echo "make test      Run this app's HTTP assertions"
+	@echo "make routes    List effective routes"
+	@echo "make audit     Check route coverage and readiness"
+	@echo "make benchmark Measure local request performance"
 	@echo "make serve     Run a fixed snapshot, without local dotenv"
 	@echo "make doctor    Show runtime/platform details"
 	@echo "Options: PORT=3001 HOST=127.0.0.1 URLCODE=urlcode"
@@ -26,5 +30,9 @@ doctor:
 	$(URLCODE) doctor
 
 .PHONY: routes audit benchmark
-routes audit benchmark:
+routes benchmark:
 	$(URLCODE) $@ --project . $(ARGS)
+
+# Keep the expected count in package.json, alongside the npm audit command.
+audit:
+	npm run audit -- $(ARGS)